⬆️ bump engine.io from 6.6.2 to 6.6.9 by dependabot[bot] · Pull Request #2348 · percy/cli

dependabot · 2026-07-21T18:46:41Z

Bumps engine.io from 6.6.2 to 6.6.9.

Release notes

engine.io@6.6.9
The ws dependency was bumped to ~8.21.0 following CVE-2026-48779.
Dependencies
ws@~8.21.0 (diff)
engine.io-client@6.6.5
The ws dependency was bumped to ~8.20.1 following CVE-2026-45736.
Note from the ws maintainers:
Although the calculated CVSS severity is medium, the actual severity is believed to be low, as the flaw is only exploitable through misuse that is unlikely in practice.
Dependencies
ws@~8.20.1 (diff)
engine.io@6.6.8
The ws dependency was bumped to ~8.20.1 following CVE-2026-45736.
Note from the ws maintainers:
Although the calculated CVSS severity is medium, the actual severity is believed to be low, as the flaw is only exploitable through misuse that is unlikely in practice.
Bug Fixes
clean up resources upon WebTransport handshake failure (f86b95f)
Dependencies
ws@~8.20.1 (diff)
engine.io@6.6.7
Bug Fixes
close HTTP requests with invalid content type (fc11285)
handle invalid packets when upgrading to WebTransport (1fa1f46)
prevent WebTransport connections when a middleware is registered (d1f5aa9)
Dependencies
ws@~8.18.3 (no change)
engine.io@6.6.6

... (truncated)

Commits

9dbec81 chore(release): engine.io@6.6.9
3ad4e1f docs: improve example with PM2
0e5afee docs: add example with PM2
eab9623 docs(eio): correct maxHttpBufferSize default in JSDoc (#5508)
c17890c docs: add documentation about WebTransport
20df6ae docs(examples): add client-side load balancing example
16d1923 ci(publish): enable staged publishing
ad48a9b docs(examples): add example with HTTP/2
190572d refactor(eio-client): remove XMLHttpRequest from the definition file
fad463c docs(examples): fix duplicate self messages (#5341)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for engine.io since your current version.

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

github-actions · 2026-08-04T19:31:44Z

This PR is stale because it has been open for more than 14 days with no activity. Remove stale label or comment or this will be closed in 14 days.

Bumps [engine.io](https://github.com/socketio/socket.io) from 6.6.2 to 6.6.9. - [Release notes](https://github.com/socketio/socket.io/releases) - [Changelog](https://github.com/socketio/socket.io/blob/main/CHANGELOG.md) - [Commits](https://github.com/socketio/socket.io/compare/engine.io@6.6.2...engine.io@6.6.9) --- updated-dependencies: - dependency-name: engine.io dependency-version: 6.6.9 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-07-21T18:46:41Z

Bumps engine.io from 6.6.2 to 6.6.9.

Release notes

Sourced from engine.io's releases.

engine.io@6.6.9
The ws dependency was bumped to ~8.21.0 following CVE-2026-48779.
Dependencies
ws@~8.21.0 (diff)
engine.io-client@6.6.5
The ws dependency was bumped to ~8.20.1 following CVE-2026-45736.
Note from the ws maintainers:
Although the calculated CVSS severity is medium, the actual severity is believed to be low, as the flaw is only exploitable through misuse that is unlikely in practice.
Dependencies
ws@~8.20.1 (diff)
engine.io@6.6.8
The ws dependency was bumped to ~8.20.1 following CVE-2026-45736.
Note from the ws maintainers:
Although the calculated CVSS severity is medium, the actual severity is believed to be low, as the flaw is only exploitable through misuse that is unlikely in practice.
Bug Fixes
clean up resources upon WebTransport handshake failure (f86b95f)
Dependencies
ws@~8.20.1 (diff)
engine.io@6.6.7
Bug Fixes
close HTTP requests with invalid content type (fc11285)
handle invalid packets when upgrading to WebTransport (1fa1f46)
prevent WebTransport connections when a middleware is registered (d1f5aa9)
Dependencies
ws@~8.18.3 (no change)
engine.io@6.6.6

... (truncated)

Commits

9dbec81 chore(release): engine.io@6.6.9
3ad4e1f docs: improve example with PM2
0e5afee docs: add example with PM2
eab9623 docs(eio): correct maxHttpBufferSize default in JSDoc (#5508)
c17890c docs: add documentation about WebTransport
20df6ae docs(examples): add client-side load balancing example
16d1923 ci(publish): enable staged publishing
ad48a9b docs(examples): add example with HTTP/2
190572d refactor(eio-client): remove XMLHttpRequest from the definition file
fad463c docs(examples): fix duplicate self messages (#5341)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for engine.io since your current version.

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

github-actions · 2026-08-04T19:31:44Z

This PR is stale because it has been open for more than 14 days with no activity. Remove stale label or comment or this will be closed in 14 days.

Bumps [engine.io](https://github.com/socketio/socket.io) from 6.6.2 to 6.6.9. - [Release notes](https://github.com/socketio/socket.io/releases) - [Changelog](https://github.com/socketio/socket.io/blob/main/CHANGELOG.md) - [Commits](https://github.com/socketio/socket.io/compare/engine.io@6.6.2...engine.io@6.6.9) --- updated-dependencies: - dependency-name: engine.io dependency-version: 6.6.9 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-07-21T18:46:41Z

Bumps engine.io from 6.6.2 to 6.6.9.

Release notes

Sourced from engine.io's releases.

engine.io@6.6.9
The ws dependency was bumped to ~8.21.0 following CVE-2026-48779.
Dependencies
ws@~8.21.0 (diff)
engine.io-client@6.6.5
The ws dependency was bumped to ~8.20.1 following CVE-2026-45736.
Note from the ws maintainers:
Although the calculated CVSS severity is medium, the actual severity is believed to be low, as the flaw is only exploitable through misuse that is unlikely in practice.
Dependencies
ws@~8.20.1 (diff)
engine.io@6.6.8
The ws dependency was bumped to ~8.20.1 following CVE-2026-45736.
Note from the ws maintainers:
Although the calculated CVSS severity is medium, the actual severity is believed to be low, as the flaw is only exploitable through misuse that is unlikely in practice.
Bug Fixes
clean up resources upon WebTransport handshake failure (f86b95f)
Dependencies
ws@~8.20.1 (diff)
engine.io@6.6.7
Bug Fixes
close HTTP requests with invalid content type (fc11285)
handle invalid packets when upgrading to WebTransport (1fa1f46)
prevent WebTransport connections when a middleware is registered (d1f5aa9)
Dependencies
ws@~8.18.3 (no change)
engine.io@6.6.6

... (truncated)

Commits

9dbec81 chore(release): engine.io@6.6.9
3ad4e1f docs: improve example with PM2
0e5afee docs: add example with PM2
eab9623 docs(eio): correct maxHttpBufferSize default in JSDoc (#5508)
c17890c docs: add documentation about WebTransport
20df6ae docs(examples): add client-side load balancing example
16d1923 ci(publish): enable staged publishing
ad48a9b docs(examples): add example with HTTP/2
190572d refactor(eio-client): remove XMLHttpRequest from the definition file
fad463c docs(examples): fix duplicate self messages (#5341)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for engine.io since your current version.

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

github-actions · 2026-08-04T19:31:44Z

This PR is stale because it has been open for more than 14 days with no activity. Remove stale label or comment or this will be closed in 14 days.

Bumps [engine.io](https://github.com/socketio/socket.io) from 6.6.2 to 6.6.9. - [Release notes](https://github.com/socketio/socket.io/releases) - [Changelog](https://github.com/socketio/socket.io/blob/main/CHANGELOG.md) - [Commits](https://github.com/socketio/socket.io/compare/engine.io@6.6.2...engine.io@6.6.9) --- updated-dependencies: - dependency-name: engine.io dependency-version: 6.6.9 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-07-21T18:46:41Z

Bumps engine.io from 6.6.2 to 6.6.9.

Release notes

Sourced from engine.io's releases.

engine.io@6.6.9
The ws dependency was bumped to ~8.21.0 following CVE-2026-48779.
Dependencies
ws@~8.21.0 (diff)
engine.io-client@6.6.5
The ws dependency was bumped to ~8.20.1 following CVE-2026-45736.
Note from the ws maintainers:
Although the calculated CVSS severity is medium, the actual severity is believed to be low, as the flaw is only exploitable through misuse that is unlikely in practice.
Dependencies
ws@~8.20.1 (diff)
engine.io@6.6.8
The ws dependency was bumped to ~8.20.1 following CVE-2026-45736.
Note from the ws maintainers:
Although the calculated CVSS severity is medium, the actual severity is believed to be low, as the flaw is only exploitable through misuse that is unlikely in practice.
Bug Fixes
clean up resources upon WebTransport handshake failure (f86b95f)
Dependencies
ws@~8.20.1 (diff)
engine.io@6.6.7
Bug Fixes
close HTTP requests with invalid content type (fc11285)
handle invalid packets when upgrading to WebTransport (1fa1f46)
prevent WebTransport connections when a middleware is registered (d1f5aa9)
Dependencies
ws@~8.18.3 (no change)
engine.io@6.6.6

... (truncated)

Commits

9dbec81 chore(release): engine.io@6.6.9
3ad4e1f docs: improve example with PM2
0e5afee docs: add example with PM2
eab9623 docs(eio): correct maxHttpBufferSize default in JSDoc (#5508)
c17890c docs: add documentation about WebTransport
20df6ae docs(examples): add client-side load balancing example
16d1923 ci(publish): enable staged publishing
ad48a9b docs(examples): add example with HTTP/2
190572d refactor(eio-client): remove XMLHttpRequest from the definition file
fad463c docs(examples): fix duplicate self messages (#5341)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for engine.io since your current version.

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

github-actions · 2026-08-04T19:31:44Z

This PR is stale because it has been open for more than 14 days with no activity. Remove stale label or comment or this will be closed in 14 days.

Bumps [engine.io](https://github.com/socketio/socket.io) from 6.6.2 to 6.6.9. - [Release notes](https://github.com/socketio/socket.io/releases) - [Changelog](https://github.com/socketio/socket.io/blob/main/CHANGELOG.md) - [Commits](https://github.com/socketio/socket.io/compare/engine.io@6.6.2...engine.io@6.6.9) --- updated-dependencies: - dependency-name: engine.io dependency-version: 6.6.9 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-07-21T18:46:41Z

Bumps engine.io from 6.6.2 to 6.6.9.

Release notes

Sourced from engine.io's releases.

engine.io@6.6.9
The ws dependency was bumped to ~8.21.0 following CVE-2026-48779.
Dependencies
ws@~8.21.0 (diff)
engine.io-client@6.6.5
The ws dependency was bumped to ~8.20.1 following CVE-2026-45736.
Note from the ws maintainers:
Although the calculated CVSS severity is medium, the actual severity is believed to be low, as the flaw is only exploitable through misuse that is unlikely in practice.
Dependencies
ws@~8.20.1 (diff)
engine.io@6.6.8
The ws dependency was bumped to ~8.20.1 following CVE-2026-45736.
Note from the ws maintainers:
Although the calculated CVSS severity is medium, the actual severity is believed to be low, as the flaw is only exploitable through misuse that is unlikely in practice.
Bug Fixes
clean up resources upon WebTransport handshake failure (f86b95f)
Dependencies
ws@~8.20.1 (diff)
engine.io@6.6.7
Bug Fixes
close HTTP requests with invalid content type (fc11285)
handle invalid packets when upgrading to WebTransport (1fa1f46)
prevent WebTransport connections when a middleware is registered (d1f5aa9)
Dependencies
ws@~8.18.3 (no change)
engine.io@6.6.6

... (truncated)

Commits

9dbec81 chore(release): engine.io@6.6.9
3ad4e1f docs: improve example with PM2
0e5afee docs: add example with PM2
eab9623 docs(eio): correct maxHttpBufferSize default in JSDoc (#5508)
c17890c docs: add documentation about WebTransport
20df6ae docs(examples): add client-side load balancing example
16d1923 ci(publish): enable staged publishing
ad48a9b docs(examples): add example with HTTP/2
190572d refactor(eio-client): remove XMLHttpRequest from the definition file
fad463c docs(examples): fix duplicate self messages (#5341)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for engine.io since your current version.

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

github-actions · 2026-08-04T19:31:44Z

This PR is stale because it has been open for more than 14 days with no activity. Remove stale label or comment or this will be closed in 14 days.

Bumps [engine.io](https://github.com/socketio/socket.io) from 6.6.2 to 6.6.9. - [Release notes](https://github.com/socketio/socket.io/releases) - [Changelog](https://github.com/socketio/socket.io/blob/main/CHANGELOG.md) - [Commits](https://github.com/socketio/socket.io/compare/engine.io@6.6.2...engine.io@6.6.9) --- updated-dependencies: - dependency-name: engine.io dependency-version: 6.6.9 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-07-21T18:46:41Z

Bumps engine.io from 6.6.2 to 6.6.9.

Release notes

Sourced from engine.io's releases.

engine.io@6.6.9
The ws dependency was bumped to ~8.21.0 following CVE-2026-48779.
Dependencies
ws@~8.21.0 (diff)
engine.io-client@6.6.5
The ws dependency was bumped to ~8.20.1 following CVE-2026-45736.
Note from the ws maintainers:
Although the calculated CVSS severity is medium, the actual severity is believed to be low, as the flaw is only exploitable through misuse that is unlikely in practice.
Dependencies
ws@~8.20.1 (diff)
engine.io@6.6.8
The ws dependency was bumped to ~8.20.1 following CVE-2026-45736.
Note from the ws maintainers:
Although the calculated CVSS severity is medium, the actual severity is believed to be low, as the flaw is only exploitable through misuse that is unlikely in practice.
Bug Fixes
clean up resources upon WebTransport handshake failure (f86b95f)
Dependencies
ws@~8.20.1 (diff)
engine.io@6.6.7
Bug Fixes
close HTTP requests with invalid content type (fc11285)
handle invalid packets when upgrading to WebTransport (1fa1f46)
prevent WebTransport connections when a middleware is registered (d1f5aa9)
Dependencies
ws@~8.18.3 (no change)
engine.io@6.6.6

... (truncated)

Commits

9dbec81 chore(release): engine.io@6.6.9
3ad4e1f docs: improve example with PM2
0e5afee docs: add example with PM2
eab9623 docs(eio): correct maxHttpBufferSize default in JSDoc (#5508)
c17890c docs: add documentation about WebTransport
20df6ae docs(examples): add client-side load balancing example
16d1923 ci(publish): enable staged publishing
ad48a9b docs(examples): add example with HTTP/2
190572d refactor(eio-client): remove XMLHttpRequest from the definition file
fad463c docs(examples): fix duplicate self messages (#5341)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for engine.io since your current version.

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

github-actions · 2026-08-04T19:31:44Z

This PR is stale because it has been open for more than 14 days with no activity. Remove stale label or comment or this will be closed in 14 days.

Bumps [engine.io](https://github.com/socketio/socket.io) from 6.6.2 to 6.6.9. - [Release notes](https://github.com/socketio/socket.io/releases) - [Changelog](https://github.com/socketio/socket.io/blob/main/CHANGELOG.md) - [Commits](https://github.com/socketio/socket.io/compare/engine.io@6.6.2...engine.io@6.6.9) --- updated-dependencies: - dependency-name: engine.io dependency-version: 6.6.9 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-07-21T18:46:41Z

Bumps engine.io from 6.6.2 to 6.6.9.

Release notes

Sourced from engine.io's releases.

engine.io@6.6.9
The ws dependency was bumped to ~8.21.0 following CVE-2026-48779.
Dependencies
ws@~8.21.0 (diff)
engine.io-client@6.6.5
The ws dependency was bumped to ~8.20.1 following CVE-2026-45736.
Note from the ws maintainers:
Although the calculated CVSS severity is medium, the actual severity is believed to be low, as the flaw is only exploitable through misuse that is unlikely in practice.
Dependencies
ws@~8.20.1 (diff)
engine.io@6.6.8
The ws dependency was bumped to ~8.20.1 following CVE-2026-45736.
Note from the ws maintainers:
Although the calculated CVSS severity is medium, the actual severity is believed to be low, as the flaw is only exploitable through misuse that is unlikely in practice.
Bug Fixes
clean up resources upon WebTransport handshake failure (f86b95f)
Dependencies
ws@~8.20.1 (diff)
engine.io@6.6.7
Bug Fixes
close HTTP requests with invalid content type (fc11285)
handle invalid packets when upgrading to WebTransport (1fa1f46)
prevent WebTransport connections when a middleware is registered (d1f5aa9)
Dependencies
ws@~8.18.3 (no change)
engine.io@6.6.6

... (truncated)

Commits

9dbec81 chore(release): engine.io@6.6.9
3ad4e1f docs: improve example with PM2
0e5afee docs: add example with PM2
eab9623 docs(eio): correct maxHttpBufferSize default in JSDoc (#5508)
c17890c docs: add documentation about WebTransport
20df6ae docs(examples): add client-side load balancing example
16d1923 ci(publish): enable staged publishing
ad48a9b docs(examples): add example with HTTP/2
190572d refactor(eio-client): remove XMLHttpRequest from the definition file
fad463c docs(examples): fix duplicate self messages (#5341)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for engine.io since your current version.

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

github-actions · 2026-08-04T19:31:44Z

This PR is stale because it has been open for more than 14 days with no activity. Remove stale label or comment or this will be closed in 14 days.

Bumps [engine.io](https://github.com/socketio/socket.io) from 6.6.2 to 6.6.9. - [Release notes](https://github.com/socketio/socket.io/releases) - [Changelog](https://github.com/socketio/socket.io/blob/main/CHANGELOG.md) - [Commits](https://github.com/socketio/socket.io/compare/engine.io@6.6.2...engine.io@6.6.9) --- updated-dependencies: - dependency-name: engine.io dependency-version: 6.6.9 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-07-21T18:46:41Z

Bumps engine.io from 6.6.2 to 6.6.9.

Release notes

Sourced from engine.io's releases.

engine.io@6.6.9
The ws dependency was bumped to ~8.21.0 following CVE-2026-48779.
Dependencies
ws@~8.21.0 (diff)
engine.io-client@6.6.5
The ws dependency was bumped to ~8.20.1 following CVE-2026-45736.
Note from the ws maintainers:
Although the calculated CVSS severity is medium, the actual severity is believed to be low, as the flaw is only exploitable through misuse that is unlikely in practice.
Dependencies
ws@~8.20.1 (diff)
engine.io@6.6.8
The ws dependency was bumped to ~8.20.1 following CVE-2026-45736.
Note from the ws maintainers:
Although the calculated CVSS severity is medium, the actual severity is believed to be low, as the flaw is only exploitable through misuse that is unlikely in practice.
Bug Fixes
clean up resources upon WebTransport handshake failure (f86b95f)
Dependencies
ws@~8.20.1 (diff)
engine.io@6.6.7
Bug Fixes
close HTTP requests with invalid content type (fc11285)
handle invalid packets when upgrading to WebTransport (1fa1f46)
prevent WebTransport connections when a middleware is registered (d1f5aa9)
Dependencies
ws@~8.18.3 (no change)
engine.io@6.6.6

... (truncated)

Commits

9dbec81 chore(release): engine.io@6.6.9
3ad4e1f docs: improve example with PM2
0e5afee docs: add example with PM2
eab9623 docs(eio): correct maxHttpBufferSize default in JSDoc (#5508)
c17890c docs: add documentation about WebTransport
20df6ae docs(examples): add client-side load balancing example
16d1923 ci(publish): enable staged publishing
ad48a9b docs(examples): add example with HTTP/2
190572d refactor(eio-client): remove XMLHttpRequest from the definition file
fad463c docs(examples): fix duplicate self messages (#5341)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for engine.io since your current version.

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

github-actions · 2026-08-04T19:31:44Z

This PR is stale because it has been open for more than 14 days with no activity. Remove stale label or comment or this will be closed in 14 days.

Bumps [engine.io](https://github.com/socketio/socket.io) from 6.6.2 to 6.6.9. - [Release notes](https://github.com/socketio/socket.io/releases) - [Changelog](https://github.com/socketio/socket.io/blob/main/CHANGELOG.md) - [Commits](https://github.com/socketio/socket.io/compare/engine.io@6.6.2...engine.io@6.6.9) --- updated-dependencies: - dependency-name: engine.io dependency-version: 6.6.9 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>

dependabotBot added the ⬆️⬇️ dependencies Pull requests that update a dependency file label Jul 21, 2026

dependabotBot requested a review from a team as a code owner July 21, 2026 18:46

dependabotBot requested review from aryanku-dev and pranavz28 July 21, 2026 18:46

github-actionsBot added the 🍞 stale Closed due to inactivity label Aug 4, 2026

dependabotBotforce-pushed the dependabot/npm_and_yarn/engine.io-6.6.9 branch from 8a08f86 to f6b9088Compare August 10, 2026 13:00

dependabotBotforce-pushed the dependabot/npm_and_yarn/engine.io-6.6.9 branch from f6b9088 to d4698a3Compare August 11, 2026 06:36

github-actionsBot removed the 🍞 stale Closed due to inactivity label Aug 11, 2026